889023eac38801449ee85942ce684228c37e1299b88e9fd83cddf23070a08d07

General

Target

64759bf4eb2e911726bb066b5adb062d_JaffaCakes118.html
Size

520KB
MD5

64759bf4eb2e911726bb066b5adb062d
SHA1

c8a1b643d15edd19c1fb276ab5fd317bdfc9f95f
SHA256

889023eac38801449ee85942ce684228c37e1299b88e9fd83cddf23070a08d07
SHA512

d33d19b9e6acd462093bec889ab40d9a5771e1fbabd0c7925380b43735a865d7dd9d14d517ab7123400d2f91971e7a38cb91b717b22bf61d7de1d165d4dcc3e5
SSDEEP

6144:STcsMYod+X3oI+YGVsjVQJsMYod+X3oI+YGVsjV0sMYod+X3oI+YGVsjVP:YK5d+X3zjVQV5d+X3zjVC5d+X3zjVP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1196	msedge.exe
1196	msedge.exe
1124	msedge.exe
1124	msedge.exe
4936	identity_helper.exe
4936	identity_helper.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1124 msedge.exe
1124 msedge.exe
1124 msedge.exe
1124 msedge.exe
1124 msedge.exe
1124 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1124 wrote to memory of 4140	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 4140	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 3096	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1196	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 1196	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 5628	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 5628	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 5628	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 5628	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 5628	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 5628	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 5628	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 5628	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 5628	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 5628	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 5628	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 5628	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 5628	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 5628	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 5628	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 5628	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 5628	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 5628	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 5628	1124	msedge.exe	msedge.exe
PID 1124 wrote to memory of 5628	1124	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\64759bf4eb2e911726bb066b5adb062d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa127d46f8,0x7ffa127d4708,0x7ffa127d4718
2⤵
PID:4140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,13736663766771381088,15785701616750179739,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
2⤵
PID:3096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,13736663766771381088,15785701616750179739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,13736663766771381088,15785701616750179739,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
2⤵
PID:5628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13736663766771381088,15785701616750179739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
2⤵
PID:5432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13736663766771381088,15785701616750179739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
2⤵
PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,13736663766771381088,15785701616750179739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
2⤵
PID:5888

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,13736663766771381088,15785701616750179739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13736663766771381088,15785701616750179739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
2⤵
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13736663766771381088,15785701616750179739,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
2⤵
PID:5380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13736663766771381088,15785701616750179739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
2⤵
PID:3896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13736663766771381088,15785701616750179739,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
2⤵
PID:5652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,13736663766771381088,15785701616750179739,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7e2e513a-3cbb-415d-8ee4-2449ab012f96.tmp

Filesize
11KB

MD5
82a33e190e909b0aafb0c6b11affbfd8

SHA1
ddcc2e05f07bc077f2ecb1e4a8f00cc2512a3c01

SHA256
4e647268e5d1f578f98579203a85efadc98f894700910e14786c899f302d9f34

SHA512
01d76b22b317f0dbcc9612cf4e7907471f5dc1039e7ad19b9be6f2d6b1ef034ed0df621f06e687b2772a485cea06245191275b86e2da80cdbc1c87114298f44d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9e04043fa014a61fbf57356af5a12c50

SHA1
603b88f87bb8c6102fef6c7d033dfd723e77e236

SHA256
56db16e22758c49f54f68694f7003aa33bd62d2570e7b652d9662e7aa31f0c66

SHA512
6b5ecbcd9789f7f3abe198bd123ea133ff1c8875c442bbd988e49c544c543f2ca7470a8d983d3a3cb502f84424e3625ad35cee1e3a16c946eee7dccff2b2ce88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b60332ea24ed5eecbda221316321de6b

SHA1
fd1dce5ea51ad27bbf50e8e979186c10242d6d71

SHA256
8e502c8407548d4a1efa99516f87dbb6418aaf2bf3abeeb02baaf5f5ad428f90

SHA512
0bfc4282b8715ab06e816168c4b15a83c694c3e74d8573325c99e9085f3193d80e052e016ec87fae10367b8dcf323209bfc07edbffcb1d6a93de9d96b79ca8cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
\??\pipe\LOCAL\crashpad_1124_KZVMSPBREDMUEGFH

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads